Legal
Privacy Policy
Who we are
Liminal Keys is operated by Liminal (Spain / EU orientation for public notices). Production hosting runs on a cloud infrastructure provider in an EU region.
What this service does
Liminal Keys provides cloud-hosted virtual certificates for macOS app signing. Private signing keys remain in cloud HSM custody. The Mac agent uses CryptoTokenKit; administrators use Liminal Console to manage identities, devices, policy rules, and audit.
Data we may process
- Account and directory identifiers from your organization’s identity provider for Console users
- Tenant, device, certificate metadata, and policy configuration needed to authorize signs
- Sign audit records (outcome, identifiers, timestamps — not digests, signatures, or key material)
- Operational telemetry without private key bytes
- Contact messages you send to published @liminalkeys.com addresses
- Standard web server and CDN logs for the public marketing site (IP, user agent, requested path)
What we do not put on this site
The public marketing pages do not request or display private keys, PKCS#12 files, enrollment codes, or device bearer credentials.
Legal bases (EU / GDPR orientation)
Processing is oriented toward performance of a contract or pre-contractual steps for the SaaS, legitimate interests in securing the service and preventing abuse, and compliance with legal obligations where they apply. Where consent is required for a specific optional channel, we will ask for it separately.
Retention
Account, device, and audit data are retained while the tenant subscription is active and for a limited period afterward as needed for security, billing disputes, and legal requirements. Marketing-site logs follow the hosting platform’s default retention.
International transfers
The production stack runs in an EU cloud region (West Europe for the current deployment). Cloud infrastructure subprocessors may process data under their platform terms. Contact us if you need a current subprocessors list.
Your rights
Depending on applicable EU/EEA law, you may request access, rectification, erasure, restriction, portability, or objection. You may also lodge a complaint with your local supervisory authority (in Spain, the AEPD). Email legal@liminalkeys.com to exercise rights related to this service.
Contact
Privacy and legal notices: legal@liminalkeys.com. Product inquiries: contact@liminalkeys.com. See also Contact.